CVE-2026-85650: Server-Side Request Forgery (SSRF) in triggerdotdev trigger.dev

CVE-2026-85650 is a server-side request forgery vulnerability affecting trigger.dev before version 4.5.2. The issue arises because webhook alert channel delivery URLs are fetched without validation or SSRF protections. Authenticated users who are members of an organization can exploit this by creating alert channels with URLs that point to internal services or metadata endpoints. Consequently, the server can be coerced into making POST requests to these restricted internal resources, potentially exposing sensitive internal network services.

The vulnerability allows authenticated organization members to cause the server to send POST requests to internal or restricted resources, potentially leading to unauthorized interactions with internal services. This could expose internal endpoints or metadata services that are not intended to be accessible externally. The CVSS score of 5.3 indicates a medium severity impact with network attack vector, low complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates. In the meantime, restrict organization membership to trusted users and review alert channel configurations to prevent misuse.